PaloAlto and VCS gateway - H323 / SIP

[VinceM]

Hi all,

Installing a palo on network with VCSExpressway (cisco ToIP) module.

After reading other discussion (https://live.paloaltonetworks.com/message/7757#7757, https://live.paloaltonetworks.com/message/12132#12132, , for a "full" compatibility between palo and VCS, we have to create app override for disabling the app L7 PA's analyse (for NAT reason). The Cisco argue is our VCS know perfectly H323 and SIP, more than your fw which is just a FW ...

Does anybody have feedback about this archietecture ? what is for you the best practice, disbaling L7 on palo or disabling NAT on VCS ?

If you have create App overide please can you explain which rule you have create.

Thx for your help

V.

[mikand · Accepted solution]

Personally I would go for disabling NAT on the VCS to keep the L7 functionality of your PA.

Otherwise you can just place a switch with an ACL that allows certain ports towards your VCS unit which would be far cheaper than having a real FW such as PA to do the same (which is the case if you disable L7 on the PA via app override).

But it also depends on in which order you have connected the devices and such (which flow the packets will take).

[ttanzi]

One question on this. If you have the firewall policies configured to allow the SIP traffic just based on ports/services and not based on the application of 'SIP' will you still need an override policy? If the rule is based on strictly ports/services, will the SIP traffic still be analyzed and require an override?

We can see in the logs that it is identified as SIP but the policy is written utilizing only the desired ports.

thanks